Threat intelligence
Microsoft Security Bulletin Coverage for March 2026
Overview
Microsoft’s March 2026 Patch Tuesday has 84 vulnerabilities, of which 45 are Elevation of Privilege. SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of March 2026 and has produced coverage for six of the reported vulnerabilities.
Vulnerabilities with Detections
CVE | CVE Title | Signature |
| CVE-2026-23668 | Windows Graphics Component Elevation of Privilege Vulnerability | ASPY 7190 Exploit-exe exe.MP_499 |
| CVE-2026-24289 | Windows Kernel Elevation of Privilege Vulnerability | ASPY 7191 Exploit-exe exe.MP_502 |
| CVE-2026-24291 | Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability | ASPY 7192 Exploit-exe exe.MP_503 |
| CVE-2026-24294 | Windows SMB Server Elevation of Privilege Vulnerability | IPS 4615 Windows SMB Server Elevation of Privilege (CVE-2026-24294) |
| CVE-2026-25187 | Winlogon Elevation of Privilege Vulnerability | ASPY 673 Exploit-exe exe.MP_501 |
| CVE-2026-26132 | Windows Kernel Elevation of Privilege Vulnerability | ASPY 671 Exploit-exe exe.MP_500 |
Release Breakdown
The vulnerabilities can be classified into the following categories:
For March there are 8 critical and 76 important vulnerabilities.
Microsoft tracks vulnerabilities that are being actively exploited at the time of discovery and those that have been disclosed publicly before the patch Tuesday release for each month. The above chart displays these metrics as seen each month.
Release Detailed Breakdown
Denial of Service Vulnerabilities
| CVE | CVE Title |
| CVE-2026-25168 | Windows Graphics Component Denial of Service Vulnerability |
| CVE-2026-25169 | Windows Graphics Component Denial of Service Vulnerability |
| CVE-2026-26127 | .NET Denial of Service Vulnerability |
| CVE-2026-26130 | ASP.NET Core Denial of Service Vulnerability |
Elevation of Privilege Vulnerabilities
| CVE | CVE Title |
| CVE-2026-20967 | System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability |
| CVE-2026-21262 | SQL Server Elevation of Privilege Vulnerability |
| CVE-2026-23651 | Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability |
| CVE-2026-23660 | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability |
| CVE-2026-23665 | Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability |
| CVE-2026-23667 | Broadcast DVR Elevation of Privilege Vulnerability |
| CVE-2026-23668 | Windows Graphics Component Elevation of Privilege Vulnerability |
| CVE-2026-23671 | Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability |
| CVE-2026-23672 | Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability |
| CVE-2026-23673 | Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability |
| CVE-2026-24283 | Multiple UNC Provider Kernel Driver Elevation of Privilege Vulnerability |
| CVE-2026-24285 | Win32k Elevation of Privilege Vulnerability |
| CVE-2026-24287 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2026-24289 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2026-24290 | Windows Projected File System Elevation of Privilege Vulnerability |
| CVE-2026-24291 | Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability |
| CVE-2026-24292 | Windows Connected Devices Platform Service Elevation of Privilege Vulnerability |
| CVE-2026-24293 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-24294 | Windows SMB Server Elevation of Privilege Vulnerability |
| CVE-2026-24295 | Windows Device Association Service Elevation of Privilege Vulnerability |
| CVE-2026-24296 | Windows Device Association Service Elevation of Privilege Vulnerability |
| CVE-2026-25165 | Performance Counters for Windows Elevation of Privilege Vulnerability |
| CVE-2026-25167 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
| CVE-2026-25170 | Windows Hyper-V Elevation of Privilege Vulnerability |
| CVE-2026-25171 | Windows Authentication Elevation of Privilege Vulnerability |
| CVE-2026-25174 | Windows Extensible File Allocation Table Elevation of Privilege Vulnerability |
| CVE-2026-25175 | Windows NTFS Elevation of Privilege Vulnerability |
| CVE-2026-25176 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-25177 | Active Directory Domain Services Elevation of Privilege Vulnerability |
| CVE-2026-25178 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-25179 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
| CVE-2026-25187 | Winlogon Elevation of Privilege Vulnerability |
| CVE-2026-25188 | Windows Telephony Service Elevation of Privilege Vulnerability |
| CVE-2026-25189 | Windows DWM Core Library Elevation of Privilege Vulnerability |
| CVE-2026-26115 | SQL Server Elevation of Privilege Vulnerability |
| CVE-2026-26116 | SQL Server Elevation of Privilege Vulnerability |
| CVE-2026-26117 | Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability |
| CVE-2026-26118 | Azure MCP Server Tools Elevation of Privilege Vulnerability |
| CVE-2026-26124 | Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability |
| CVE-2026-26125 | Payment Orchestrator Service Elevation of Privilege Vulnerability |
| CVE-2026-26128 | Windows SMB Server Elevation of Privilege Vulnerability |
| CVE-2026-26131 | .NET Elevation of Privilege Vulnerability |
| CVE-2026-26132 | Windows Kernel Elevation of Privilege Vulnerability |
| CVE-2026-26141 | Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability |
| CVE-2026-26148 | Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability |
Information Disclosure Vulnerabilities
| CVE | CVE Title |
| CVE-2026-23661 | Azure IoT Explorer Information Disclosure Vulnerability |
| CVE-2026-23662 | Azure IoT Explorer Information Disclosure Vulnerability |
| CVE-2026-23664 | Azure IoT Explorer Information Disclosure Vulnerability |
| CVE-2026-24282 | Push message Routing Service Elevation of Privilege Vulnerability |
| CVE-2026-25180 | Windows Graphics Component Information Disclosure Vulnerability |
| CVE-2026-25181 | GDI+ Information Disclosure Vulnerability |
| CVE-2026-25186 | Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure Vulnerability |
| CVE-2026-26122 | Microsoft ACI Confidential Containers Information Disclosure Vulnerability |
| CVE-2026-26123 | Microsoft Authenticator Information Disclosure Vulnerability |
| CVE-2026-26134 | Microsoft Office Elevation of Privilege Vulnerability |
| CVE-2026-26144 | Microsoft Excel Information Disclosure Vulnerability |
Remote Code Execution Vulnerabilities
| CVE | CVE Title |
| CVE-2026-21536 | Microsoft Devices Pricing Program Remote Code Execution Vulnerability |
| CVE-2026-23654 | GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability |
| CVE-2026-23669 | Windows Print Spooler Remote Code Execution Vulnerability |
| CVE-2026-24288 | Windows Mobile Broadband Driver Remote Code Execution Vulnerability |
| CVE-2026-25166 | Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution Vulnerability |
| CVE-2026-25172 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2026-25173 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2026-25190 | GDI Remote Code Execution Vulnerability |
| CVE-2026-26106 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
| CVE-2026-26107 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2026-26108 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2026-26109 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2026-26110 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2026-26111 | Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability |
| CVE-2026-26112 | Microsoft Excel Remote Code Execution Vulnerability |
| CVE-2026-26113 | Microsoft Office Remote Code Execution Vulnerability |
| CVE-2026-26114 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
Security Feature Bypass Vulnerabilities
| CVE | CVE Title |
| CVE-2026-23674 | MapUrlToZone Security Feature Bypass Vulnerability |
| CVE-2026-24297 | Windows Kerberos Security Feature Bypass Vulnerability |
| CVE-2026-26143 | Microsoft PowerShell Security Feature Bypass Vulnerability |
Spoofing Vulnerabilities
| CVE | CVE Title |
| CVE-2026-23656 | Windows App Installer Spoofing Vulnerability |
| CVE-2026-25185 | Windows Shell Link Processing Spoofing Vulnerability |
| CVE-2026-26105 | Microsoft SharePoint Server Spoofing Vulnerability |
| CVE-2026-26121 | Azure IOT Explorer Spoofing Vulnerability |
Share This Article
An Article By
An Article By
Security News
Security News
The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.
